How to find who created a AWS RDS DB instance?

user_3078630 0
Viewed 5963

I want to find who created a particular AWS RDS DB instance. I tried two ways:

Is there a way to find out this or not? If yes, Can anyone help to find out the createdBy flag?

amazon-rds amazon-web-services
2 Answers

You can configure Cloudtrail to send all log events to Cloudwatch by following the instructions here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html

That allows you interrogate the logs using the rich query syntax seen here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-examples.html

Once the CLoudtrail -> Cloudwatch is in place, use the following query to list the creators of RDS instances along with size and other useful info:

fields eventName, requestParameters.dBInstanceClass as dbsize,  requestParameters.dBInstanceIdentifier as dbname, userIdentity.userName, eventSource, @timestamp, @message
| sort dbsize, dbname desc
| filter (eventName like 'CreateDBInstance') and  eventSource='rds.amazonaws.com'

You would run the above query in Cloudwatch -❯ Logs -> Insights. A direct link for London is : https://eu-west-2.console.aws.amazon.com/cloudwatch/home?region=eu-west-2#logs-insights:

user_3257420
Related